CERT-In Directions: 6-Hour Reporting and 180-Day Logs

Q: Who do the CERT-In directions of 28 April 2022 actually apply to?

The directions bind service providers, intermediaries, data centres, body corporates and government organisations. "Body corporate" is defined by reference to Section 43A of the IT Act and covers any company, firm, sole proprietorship or association engaged in commercial or professional activities, so almost every business is in scope. CERT-In's own FAQ states that the directions apply to foreign firms serving Indian customers in the matter of cyber incidents and cyber security incidents, that entities without a physical presence in India offering services to users in the country must still designate a point of contact, and that the reporting duty is statutory and overrides any confidentiality clause in a customer contract by virtue of Section 81 of the IT Act. Additional obligations on customer validation apply specifically to data centres, VPS, cloud and VPN service providers, and on KYC and transaction records to virtual-asset service providers, exchanges and custodian wallets.

Q: When does the six-hour reporting clock start, and what if we do not have full details?

The clock starts when the incident is noticed or brought to the organisation's notice, not when it is confirmed or the root cause is understood. CERT-In's FAQ is explicit that organisations must deploy controls capable of detecting incidents and that the six hours run from noticing. It also states that entities may report with the information available at the time and supply additional details later within a reasonable time, which means a partial report inside six hours is compliant and a complete report at hour nine is not. Architecturally, this makes the definition of "noticed" the most important design decision: treat it as a system event — an alert mapping to an Annexure I category firing, or a report arriving on a designated channel — log it immutably, and start the timer there so the organisation can prove when the clock began.

Q: Which incidents must be reported within six hours?

Annexure I of the directions lists the incident types that must be mandatorily reported, and the FAQ highlights the categories that should be reported within the six-hour window: cyber incidents of a severe nature such as denial of service, distributed denial of service, intrusion and the spread of computer contaminants including ransomware on any part of public information infrastructure including backbone networks; data breaches and data leaks; and large-scale or frequent incidents such as intrusions into computer resources. The practical implication is that your detection catalogue should be mapped to these categories in advance, so that when an alert fires the triage question is not "is this reportable?" from first principles but a lookup against a pre-agreed mapping, which shortens the first and most variable stage of the six-hour pipeline.

Q: Does a SIEM hosted outside India satisfy the 180-day log requirement?

No. Direction (iv) requires that logs of all ICT systems be enabled, maintained securely for a rolling period of 180 days, and maintained within the Indian jurisdiction, to be provided to CERT-In along with an incident report or when directed. A retained copy sitting in a US or Singapore region does not meet the jurisdiction requirement regardless of how good the search experience is. The compliant design places the 180-day store in an Indian region — for example ap-south-1 or ap-south-2 on AWS, or an Indian sovereign provider — and treats residency as a placement decision in the same architecture that handles other India data-residency obligations. Organisations can still ship a copy to a global SIEM for detection if their other obligations allow it, but the authoritative 180-day retained copy must be in India.

Q: Is cold archival storage good enough for the 180 days of logs?

Retention alone is not the requirement; producibility is. Direction (iii) allows CERT-In to require information in a specified format and timeframe, up to near-real-time, and direction (iv) requires logs to be provided along with a report or when directed. A cold archive that takes days to restore and reindex cannot meet that. The design that works is a tiered log store: a hot window of a week to a month for detection and alerting, and a warm window covering the full 180 days that is directly queryable — columnar files on object storage, normalised to an open schema, with object lock or equivalent write-once retention so the logs are tamper-evident. Sizing is modest: an estate emitting 50 GB of logs a day needs roughly 9 TB of raw retention for 180 days, which compresses substantially in columnar format, and the storage cost in an Indian region is small relative to the cost of being unable to produce the logs.

Q: Why does the time-synchronisation direction matter so much?

Direction (i) requires all ICT system clocks to be synchronised to the NTP servers of NIC or NPL, or to servers traceable to them; entities spanning multiple geographies may use another accurate standard source provided it does not deviate from NIC and NPL. It reads like housekeeping but underpins every other obligation. CERT-In's statutory role is to correlate incidents across entities, and that only works if timestamps from different organisations refer to the same instants. Internally, logs from hosts with drifting clocks cannot be ordered reliably during an investigation, which slows the triage that the six-hour clock depends on and weakens the evidentiary value of the 180-day store. Treat drift as a security control: run a small internal NTP tier synced upstream, alert on drift, and reject or flag log lines whose timestamps are implausible relative to ingest time.

Q: How do the CERT-In directions interact with the DPDP Act and sectoral regulators like the RBI?

They stack rather than replace each other. A single data breach can simultaneously trigger the CERT-In six-hour reporting duty, the personal-data breach notification obligations to the Data Protection Board under the DPDP Act and its Rules, and sectoral reporting to a regulator such as the RBI under its cyber security framework for banks. Running these as three separate processes owned by legal, privacy and the CISO respectively produces inconsistent timelines and inconsistent facts. The robust design is one incident record with a fan-out: a single "noticed" timestamp, a single evolving set of facts, and per-regulator clocks and templates driven from the same record, with one owner accountable for all of them. This is the same structural problem that European firms face under DORA's multi-stage incident reporting, and the same solution applies.

Q: What are the penalties for not complying with the directions?

Non-compliance with directions issued under Section 70B(6) may attract the penal provisions of Section 70B(7) of the IT Act, which provides for imprisonment for a term of up to one year, a fine of up to one lakh rupees, or both. CERT-In's FAQ states that this power will be exercised reasonably and on occasions when non-compliance is deliberate. The larger practical exposure is usually not the statutory penalty but what a missed clock reveals during an investigation — an inability to say when an incident was noticed, logs that cannot be produced or were altered, or a point of contact who no longer works at the company — all of which damage the organisation's position with regulators, customers and insurers far beyond the fine itself. Building the architecture described here is the way to avoid being in that position.

Satyam Kumar

Retour au blog

cyber-security-patterns

CERT-In Directions in Practice: 6-Hour Reporting and 180-Day Logs as an Architecture (2026)

By Satyam KumarSeptember 14, 202613 min read

cert-in directions cert-in 6 hour reporting 180 day log retention section 70b it act india cyber incident reporting india data residency logs security log architecture incident response india dpdp breach notification ntp nic npl security data lake india object lock logs annexure i incidents rbi cyber security framework compliance architecture india cybersecurity compliance 2026

CERT-In Directions in Practice: 6-Hour Reporting and 180-Day Logs as an Architecture (2026)

Frequently Asked Questions

Partager l'article

Twitter LinkedIn WhatsApp

Satyam Kumar

Founder & AI Architect, AppScale LLP

Architecte AI & Cloud. J'aide les équipes à construire des systèmes qui scalent pour des millions.

LinkedIn GitHub

CERT-In Directions in Practice: 6-Hour Reporting and 180-Day Logs as an Architecture (2026)

Frequently Asked Questions

Partager l'article

Comments

Leave a comment